scm-commits March 2023

scm-commits@lists.fedoraproject.org

1 participants
36223 discussions

orion pushed to rpms/fail2ban (epel8). "Update to 1.0.1."
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:04 UTC From c29152aa29767f9a52f76e89f2df6e9995234f3d Mon Sep 17 00:00:00 2001 From: Richard Shaw <hobbes1069(a)gmail.com> Date: Oct 03 2022 02:26:37 +0000 Subject: Update to 1.0.1. --- diff --git a/.gitignore b/.gitignore index 0df6ce0..79e39c8 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,4 @@ fail2ban-0.8.4.tar.bz2 /fail2ban-0.10.5.tar.gz /fail2ban-0.11.1.tar.gz /fail2ban-0.11.2.tar.gz +/fail2ban-1.0.1.tar.gz diff --git a/fail2ban.spec b/fail2ban.spec index 15154d5..ab21ecf 100644 --- a/fail2ban.spec +++ b/fail2ban.spec @@ -1,6 +1,6 @@ Name: fail2ban -Version: 0.11.2 -Release: 14%{?dist} +Version: 1.0.1 +Release: 1%{?dist} Summary: Daemon to ban hosts that cause multiple authentication errors License: GPLv2+ @@ -15,19 +15,8 @@ Source4: Makefile # https://bugzilla.redhat.com/show_bug.cgi?id=1379141 # https://bugzilla.redhat.com/show_bug.cgi?id=1573185 Patch0: fail2ban-partof.patch -# Fixes century selector for tests -# https://bugzilla.redhat.com/show_bug.cgi?id=1912472 -Patch1: https://github.com/fail2ban/fail2ban/commit/f259dac74721c00f0184bf452771377… -# Python 3.10a5 compatibility -# https://bugzilla.redhat.com/show_bug.cgi?id=1926201 -Patch2: https://github.com/fail2ban/fail2ban/compare/ea26509594a3220b012071604d73bb… -# CVE-2021-32749 https://github.com/fail2ban/fail2ban/security/advisories/GHSA-m985-3f3v-cwmm -Patch3: https://github.com/fail2ban/fail2ban/commit/410a6ce5c80dd981c22752da034f252… -# https://github.com/fail2ban/fail2ban/issues/2882 -#Patch4: https://github.com/fail2ban/fail2ban/commit/ebf5784b8cd4b7c52d0f328b780833b… # https://bugzilla.redhat.com/show_bug.cgi?id=2034205 -Patch5: fail2ban-python311.patch -Patch6: https://patch-diff.githubusercontent.com/raw/fail2ban/fail2ban/pull/3267.pa… +Patch1: fail2ban-python311.patch BuildArch: noarch @@ -414,6 +403,9 @@ fi %changelog +* Sun Oct 02 2022 Richard Shaw <hobbes1069(a)gmail.com> - 1.0.1-1 +- Update to 1.0.1. + * Thu Jul 21 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.11.2-14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/sources b/sources index d48c0ea..90ff00d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (fail2ban-0.11.2.tar.gz) = 46b27abd947b00ea64106dbac563ef8afef38eec86684024d47d9a0e8c1969ff864ad6df7f4f8de2aa3eb1af6d769fb6796592d9f0e35521d5f95f17b8cade97 +SHA512 (fail2ban-1.0.1.tar.gz) = a4d0ee5405225b1ec950f3209bc304c1168c644d06309a187d77119f6bea12c382db046130a86411aad4210b458a16ee092269dc7953400950969a34550c6da5 https://src.fedoraproject.org/rpms/fail2ban/c/c29152aa29767f9a52f76e89f2df6…

1 0

orion pushed to rpms/fail2ban (epel8). "Add BuildRequires: make (..more)"
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:02 UTC From 049ce5633ea1723c17e35657b73cbac28e31060a Mon Sep 17 00:00:00 2001 From: Tom Stellard <tstellar(a)redhat.com> Date: Dec 18 2020 22:28:52 +0000 Subject: Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- diff --git a/fail2ban.spec b/fail2ban.spec index 3802981..dd2660a 100644 --- a/fail2ban.spec +++ b/fail2ban.spec @@ -33,6 +33,7 @@ BuildRequires: python3-inotify BuildRequires: sqlite BuildRequires: systemd BuildRequires: selinux-policy-devel +BuildRequires: make # Default components Requires: %{name}-firewalld = %{version}-%{release} https://src.fedoraproject.org/rpms/fail2ban/c/049ce5633ea1723c17e35657b73cb…

1 0

orion pushed to rpms/fail2ban (epel8). "Merge branch 'rawhide' into epel8"
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:04 UTC From 0b591ce88f39b7e1851a187c0d67f697354fb83c Mon Sep 17 00:00:00 2001 From: Orion Poplawski <orion(a)nwra.com> Date: Mar 30 2023 16:11:26 +0000 Subject: Merge branch 'rawhide' into epel8 --- diff --git a/.gitignore b/.gitignore index 0df6ce0..7fbd936 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,5 @@ fail2ban-0.8.4.tar.bz2 /fail2ban-0.10.5.tar.gz /fail2ban-0.11.1.tar.gz /fail2ban-0.11.2.tar.gz +/fail2ban-1.0.1.tar.gz +/fail2ban-1.0.2.tar.gz diff --git a/.rpmlint b/.rpmlint deleted file mode 100644 index 05ddcce..0000000 --- a/.rpmlint +++ /dev/null @@ -1,8 +0,0 @@ -from Config import * -addFilter("incoherent-logrotate-file /etc/logrotate.d/fail2ban"); -addFilter("macro-in-comment %{(name|version|release)}"); -addFilter("spelling-error .* (tcp|sendmail|shorewall|sshd)"); -# Tests -addFilter("hidden-file-or-dir .*fail2ban/tests/files/config/apache.*/\.htpasswd"); -addFilter("htaccess-file-error .*fail2ban/tests/files/config/apache.*/\.htaccess"); -addFilter("zero-length .*fail2ban/tests/files/files/"); diff --git a/ca2b94c5229bd474f612b57b67d796252a4aab7a.patch b/ca2b94c5229bd474f612b57b67d796252a4aab7a.patch new file mode 100644 index 0000000..02a9ae5 --- /dev/null +++ b/ca2b94c5229bd474f612b57b67d796252a4aab7a.patch @@ -0,0 +1,84 @@ +From ca2b94c5229bd474f612b57b67d796252a4aab7a Mon Sep 17 00:00:00 2001 +From: sebres <serg.brester(a)sebres.de> +Date: Tue, 4 Oct 2022 14:03:07 +0200 +Subject: [PATCH] fixes gh-3370: resolve extremely long search by repeated + apply of non-greedy RE `(?:: (?:[^$]+|\w+\([^$]*\))+)?` with following + branches (it may be extremely slow up to infinite search depending on + message); added new regression tests amend to gh-3210: fixes regression and + matches new format in aggressive mode too + +--- + ChangeLog | 4 ++++ + config/filter.d/dovecot.conf | 8 +++++--- + fail2ban/tests/files/logs/dovecot | 22 ++++++++++++++++++++++ + 3 files changed, 31 insertions(+), 3 deletions(-) + +Index: fail2ban-1.0.1/config/filter.d/dovecot.conf +=================================================================== +--- fail2ban-1.0.1.orig/config/filter.d/dovecot.conf ++++ fail2ban-1.0.1/config/filter.d/dovecot.conf +@@ -7,19 +7,21 @@ before = common.conf + + [Definition] + ++_daemon = (?:dovecot(?:-auth)?|auth) ++ + _auth_worker = (?:dovecot: )?auth(?:-worker)? + _auth_worker_info = (?:conn \w+:auth(?:-worker)? $[^$]+\): auth(?:-worker)?<\d+>: )? +-_daemon = (?:dovecot(?:-auth)?|auth) ++_bypass_reject_reason = (?:: (?:\w+$[^$:]*\) \w+|[^$]+))* + + prefregex = ^%(__prefix_line)s(?:%(_auth_worker)s(?:\([^$]+\))?: )?(?:%(__pam_auth)s(?:$dovecot:auth$)?: |(?:pop3|imap|managesieve|submission)-login: )?(?:Info: )?%(_auth_worker_info)s<F-CONTENT>.+</F-CONTENT>$ + + failregex = ^authentication failure; logname=<F-ALT_USER1>\S*</F-ALT_USER1> uid=\S* euid=\S* tty=dovecot ruser=<F-USER>\S*</F-USER> rhost=<HOST>(?:\s+user=<F-ALT_USER>\S*</F-ALT_USER>)?\s*$ +- ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)(?:: (?:[^$]+|\w+\([^$]*\))+)? $(?:auth failed, \d+ attempts(?: in \d+ secs)?|tried to use (?:disabled|disallowed) \S+ auth|proxy dest auth failed)$:(?: user=<<F-USER>[^>]*</F-USER>>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$ ++ ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)%(_bypass_reject_reason)s $(?:auth failed, \d+ attempts(?: in \d+ secs)?|tried to use (?:disabled|disallowed) \S+ auth|proxy dest auth failed)$:(?: user=<<F-USER>[^>]*</F-USER>>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$ + ^pam$\S+,<HOST>(?:,\S*)?$: pam_authenticate failed: (?:User not known to the underlying authentication module: \d+ Time$s$|Authentication failure $[Pp]assword mismatch\?$|Permission denied)\s*$ + ^[a-z\-]{3,15}$\S*,<HOST>(?:,\S*)?$: (?:[Uu]nknown user|[Ii]nvalid credentials|[Pp]assword mismatch) + <mdre-<mode>> + +-mdre-aggressive = ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)(?::(?: [^ $]+)+)? \((?:no auth attempts|disconnected before auth was ready,|client didn't finish \S+ auth,)(?: (?:in|waited) \d+ secs)?$:(?: user=<[^>]*>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$ ++mdre-aggressive = ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)%(_bypass_reject_reason)s $(?:no auth attempts|disconnected before auth was ready,|client didn't finish \S+ auth,)(?: (?:in|waited) \d+ secs)?$:(?: user=<[^>]*>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$ + + mdre-normal = + +Index: fail2ban-1.0.1/fail2ban/tests/files/logs/dovecot +=================================================================== +--- fail2ban-1.0.1.orig/fail2ban/tests/files/logs/dovecot ++++ fail2ban-1.0.1/fail2ban/tests/files/logs/dovecot +@@ -115,6 +115,17 @@ Aug 28 06:38:51 s166-62-100-187 dovecot: + # failJSON: { "time": "2004-08-28T06:38:52", "match": true , "host": "192.0.2.4", "desc": "open parenthesis in optional part between Disconnected and (auth failed ...), gh-3210" } + Aug 28 06:38:52 s166-62-100-187 dovecot: imap-login: Disconnected: Connection closed: read(size=1003) failed: Connection reset by peer (auth failed, 1 attempts in 0 secs): user=<test(a)example.com>, rip=192.0.2.4, lip=127.0.0.19, session=<Lsz0Oo7WXti3b7xe> + ++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: read(size=1026) failed: Connection reset by peer ++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number ++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Too many invalid commands. (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1 ++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Connection closed: read(size=1007) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1 ++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[472]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol ++ + # failJSON: { "time": "2004-08-29T03:17:18", "match": true , "host": "192.0.2.133" } + Aug 29 03:17:18 server dovecot: submission-login: Client has quit the connection (auth failed, 1 attempts in 2 secs): user=<user1>, method=LOGIN, rip=192.0.2.133, lip=0.0.0.0 + # failJSON: { "time": "2004-08-29T03:53:52", "match": true , "host": "192.0.2.169" } +@@ -128,6 +139,17 @@ Aug 29 15:33:53 server dovecot: managesi + + # filterOptions: [{"mode": "aggressive"}] + ++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: read(size=1026) failed: Connection reset by peer ++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number ++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Too many invalid commands. (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1 ++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Connection closed: read(size=1007) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1 ++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[472]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol ++ + # failJSON: { "time": "2004-08-29T16:06:58", "match": true , "host": "192.0.2.5" } + Aug 29 16:06:58 s166-62-100-187 dovecot: imap-login: Disconnected (disconnected before auth was ready, waited 0 secs): user=<>, rip=192.0.2.5, lip=192.168.1.2, TLS handshaking: SSL_accept() syscall failed: Connection reset by peer + # failJSON: { "time": "2004-08-31T16:15:10", "match": true , "host": "192.0.2.6" } diff --git a/fail2ban-python311.patch b/fail2ban-python311.patch new file mode 100644 index 0000000..8a89af7 --- /dev/null +++ b/fail2ban-python311.patch @@ -0,0 +1,21 @@ +Index: fail2ban-1.0.1/fail2ban/tests/actiontestcase.py +=================================================================== +--- fail2ban-1.0.1.orig/fail2ban/tests/actiontestcase.py ++++ fail2ban-1.0.1/fail2ban/tests/actiontestcase.py +@@ -242,14 +242,14 @@ class CommandActionTest(LogCaptureTestCa + setattr(self.__action, 'ab', "<ac>") + setattr(self.__action, 'x?family=inet6', "") + # produce self-referencing properties except: +- self.assertRaisesRegexp(ValueError, r"properties contain self referencing definitions", ++ self.assertRaisesRegex(ValueError, r"properties contain self referencing definitions", + lambda: self.__action.replaceTag("<a><b>", + self.__action._properties, conditional="family=inet4") + ) + # remore self-referencing in props: + delattr(self.__action, 'ac') + # produce self-referencing query except: +- self.assertRaisesRegexp(ValueError, r"possible self referencing definitions in query", ++ self.assertRaisesRegex(ValueError, r"possible self referencing definitions in query", + lambda: self.__action.replaceTag("<x"*30+">"*30, + self.__action._properties, conditional="family=inet6") + ) diff --git a/fail2ban.rpmlintrc b/fail2ban.rpmlintrc new file mode 100644 index 0000000..05ddcce --- /dev/null +++ b/fail2ban.rpmlintrc @@ -0,0 +1,8 @@ +from Config import * +addFilter("incoherent-logrotate-file /etc/logrotate.d/fail2ban"); +addFilter("macro-in-comment %{(name|version|release)}"); +addFilter("spelling-error .* (tcp|sendmail|shorewall|sshd)"); +# Tests +addFilter("hidden-file-or-dir .*fail2ban/tests/files/config/apache.*/\.htpasswd"); +addFilter("htaccess-file-error .*fail2ban/tests/files/config/apache.*/\.htaccess"); +addFilter("zero-length .*fail2ban/tests/files/files/"); diff --git a/fail2ban.spec b/fail2ban.spec index 3802981..4814fb2 100644 --- a/fail2ban.spec +++ b/fail2ban.spec @@ -1,6 +1,6 @@ Name: fail2ban -Version: 0.11.2 -Release: 1%{?dist} +Version: 1.0.2 +Release: 2%{?dist} Summary: Daemon to ban hosts that cause multiple authentication errors License: GPLv2+ @@ -11,10 +11,16 @@ Source1: fail2ban.fc Source2: fail2ban.if Source3: fail2ban.te Source4: Makefile + # Give up being PartOf iptables and ipset for now # https://bugzilla.redhat.com/show_bug.cgi?id=1379141 # https://bugzilla.redhat.com/show_bug.cgi?id=1573185 Patch0: fail2ban-partof.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=2034205 +Patch1: fail2ban-python311.patch +# Patch for dovecot jail eating 100% CPU +#Patch2: https://github.com/fail2ban/fail2ban/commit/ca2b94c5229bd474f612b57b67d7962… + BuildArch: noarch @@ -33,6 +39,8 @@ BuildRequires: python3-inotify BuildRequires: sqlite BuildRequires: systemd BuildRequires: selinux-policy-devel +BuildRequires: make +BuildRequires: bash-completion # Default components Requires: %{name}-firewalld = %{version}-%{release} @@ -81,9 +89,10 @@ Requires: nftables Requires(post): systemd Requires(preun): systemd Requires(postun): systemd - -%if 0%{?fedora} +%if 0%{?fedora} || 0%{?rhel} >= 8 Requires: (%{name}-selinux if selinux-policy-%{selinuxtype}) +%else +Requires: %{name}-selinux %endif %description server @@ -148,7 +157,7 @@ This package contains Fail2Ban's testscases and scripts. %package mail Summary: Mail actions for Fail2Ban Requires: %{name}-server = %{version}-%{release} -Requires: mailx +Requires: /usr/bin/mail %description mail This package installs Fail2Ban's mail actions. These are an alternative @@ -207,6 +216,10 @@ find -type f -exec sed -i -e '1s,^#!/usr/bin/python *,#!/usr/bin/python%{python3 # SELinux sources cp -p %SOURCE1 %SOURCE2 %SOURCE3 . +# 2to3 has been removed from setuptools and we already use the binary in +# %%prep. +sed -i "/use_2to3/d" setup.py + %build %if 0%{?rhel} && 0%{?rhel} < 8 @@ -216,6 +229,7 @@ cp -p %SOURCE1 %SOURCE2 %SOURCE3 . %endif make -f %SOURCE4 + %install %if 0%{?rhel} && 0%{?rhel} < 8 %py2_install @@ -253,8 +267,8 @@ cat > %{buildroot}%{_sysconfdir}/%{name}/jail.d/00-firewalld.conf <<EOF # the firewalld actions as the default actions. You can remove this package # (along with the empty fail2ban meta-package) if you do not use firewalld [DEFAULT] -banaction = firewallcmd-rich-rules[actiontype=<multiport>] -banaction_allports = firewallcmd-rich-rules[actiontype=<allports>] +banaction = firewallcmd-rich-rules +banaction_allports = firewallcmd-rich-rules EOF # systemd journal configuration @@ -275,6 +289,11 @@ rm -r %{buildroot}%{_docdir}/%{name} install -d %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype} install -m 0644 %{modulename}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype} +#BASH completion +COMPLETIONDIR=%{buildroot}$(pkg-config --variable=completionsdir bash-completion) +%__mkdir_p $COMPLETIONDIR +%__install -p -m 644 files/bash-completion $COMPLETIONDIR/fail2ban + %check %if 0%{?rhel} && 0%{?rhel} < 8 @@ -329,13 +348,14 @@ fi %exclude %{python3_sitelib}/fail2ban/tests %endif %{_unitdir}/fail2ban.service +%{_datadir}/bash-completion/ %{_mandir}/man1/fail2ban.1* %{_mandir}/man1/fail2ban-client.1* %{_mandir}/man1/fail2ban-python.1* %{_mandir}/man1/fail2ban-regex.1* %{_mandir}/man1/fail2ban-server.1* %{_mandir}/man5/*.5* -%config(noreplace) %{_sysconfdir}/fail2ban +%config(noreplace) %{_sysconfdir}/fail2ban/ %exclude %{_sysconfdir}/fail2ban/action.d/complain.conf %exclude %{_sysconfdir}/fail2ban/action.d/hostsdeny.conf %exclude %{_sysconfdir}/fail2ban/action.d/mail.conf @@ -389,6 +409,58 @@ fi %changelog +* Thu Jan 19 2023 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.0.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Sat Dec 17 2022 Richard Shaw <hobbes1069(a)gmail.com> - 1.0.2-1 +- Update to 1.0.2. + +* Wed Nov 02 2022 Richard Shaw <hobbes1069(a)gmail.com> - 1.0.1-2 +- Add patch for dovecot eating 100% CPU. + +* Sun Oct 02 2022 Richard Shaw <hobbes1069(a)gmail.com> - 1.0.1-1 +- Update to 1.0.1. + +* Thu Jul 21 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.11.2-14 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Wed Jun 15 2022 Python Maint <python-maint(a)redhat.com> - 0.11.2-13 +- Rebuilt for Python 3.11 + +* Wed May 18 2022 Orion Poplawski <orion(a)nwra.com> - 0.11.2-12 +- Fix SELinux policy to allow watch on var_log_t (bz#2083923) + +* Fri Jan 28 2022 Orion Poplawski <orion(a)nwra.com> - 0.11.2-11 +- Require /usr/bin/mail instead of mailx + +* Thu Jan 20 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.11.2-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Sun Sep 26 2021 Mikel Olasagasti Uranga <mikel(a)olasagasti.info> - 0.11.2-9 +- Fix CVE-2021-32749 RHBZ#1983223 + +* Wed Jul 21 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.11.2-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Mon Jun 07 2021 Python Maint <python-maint(a)redhat.com> - 0.11.2-7 +- Rebuilt for Python 3.10 + +* Sun Jun 06 2021 Richard Shaw <hobbes1069(a)gmail.com> - 0.11.2-6 +- Update selinux policy for Fedora 34+ + +* Fri Jun 04 2021 Python Maint <python-maint(a)redhat.com> - 0.11.2-5 +- Rebuilt for Python 3.10 + +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl> - 0.11.2-4 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + +* Tue Jan 26 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.11.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Wed Jan 06 2021 Richard Shaw <hobbes1069(a)gmail.com> - 0.11.2-2 +- Add patch to deal with a new century in tests (2021). + * Tue Nov 24 2020 Richard Shaw <hobbes1069(a)gmail.com> - 0.11.2-1 - Update to 0.11.2. diff --git a/fail2ban.te b/fail2ban.te index 302f4bc..6d36a70 100644 --- a/fail2ban.te +++ b/fail2ban.te @@ -88,7 +88,6 @@ files_read_etc_runtime_files(fail2ban_t) files_list_var(fail2ban_t) files_dontaudit_list_tmp(fail2ban_t) -fs_list_inotifyfs(fail2ban_t) fs_getattr_all_fs(fail2ban_t) auth_use_nsswitch(fail2ban_t) @@ -100,6 +99,18 @@ logging_read_syslog_pid(fail2ban_t) logging_dontaudit_search_audit_logs(fail2ban_t) logging_mmap_generic_logs(fail2ban_t) logging_mmap_journal(fail2ban_t) +allow fail2ban_t fail2ban_log_t:file watch; +# Not in EL9 yet +#logging_watch_audit_log_files(fail2ban_t) +gen_require(` + type var_log_t, auditd_log_t; +') +watch_files_pattern(fail2ban_t, auditd_log_t, auditd_log_t) +#logging_watch_audit_log_dirs(fail2ban_t) +allow fail2ban_t var_log_t:dir search_dir_perms; +watch_dirs_pattern(fail2ban_t, auditd_log_t, auditd_log_t) +logging_watch_generic_log_dirs(fail2ban_t) +logging_watch_journal_dir(fail2ban_t) mta_send_mail(fail2ban_t) diff --git a/sources b/sources index d48c0ea..6655594 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (fail2ban-0.11.2.tar.gz) = 46b27abd947b00ea64106dbac563ef8afef38eec86684024d47d9a0e8c1969ff864ad6df7f4f8de2aa3eb1af6d769fb6796592d9f0e35521d5f95f17b8cade97 +SHA512 (fail2ban-1.0.2.tar.gz) = 688a84361b5794e1658f53d2d200ce752fe1e3320ddb1742c32c4b4b82a79ace16ae464e7ea3eeb94a0e862bcac73c2d3a0e61dd7b28e179a4c857f950d74dbb https://src.fedoraproject.org/rpms/fail2ban/c/0b591ce88f39b7e1851a187c0d67f…

1 0

orion pushed to rpms/fail2ban (epel8). "Update selinux policy for Fedora 34+"
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:03 UTC From 6dbaddcefe8af280f6c8a224143c7a864a1778c0 Mon Sep 17 00:00:00 2001 From: Richard Shaw <hobbes1069(a)gmail.com> Date: Jun 06 2021 11:58:43 +0000 Subject: Update selinux policy for Fedora 34+ --- diff --git a/fail2ban.spec b/fail2ban.spec index 5a069e4..fa9cfd6 100644 --- a/fail2ban.spec +++ b/fail2ban.spec @@ -1,6 +1,6 @@ Name: fail2ban Version: 0.11.2 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Daemon to ban hosts that cause multiple authentication errors License: GPLv2+ @@ -397,6 +397,9 @@ fi %changelog +* Sun Jun 06 2021 Richard Shaw <hobbes1069(a)gmail.com> - 0.11.2-5 +- Update selinux policy for Fedora 34+ + * Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl> - 0.11.2-4 - Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. diff --git a/fail2ban.te b/fail2ban.te index 302f4bc..92615ca 100644 --- a/fail2ban.te +++ b/fail2ban.te @@ -45,6 +45,7 @@ allow fail2ban_t self:netlink_netfilter_socket create_socket_perms; read_files_pattern(fail2ban_t, fail2ban_t, fail2ban_t) +allow fail2ban_t fail2ban_log_t:file watch; append_files_pattern(fail2ban_t, fail2ban_log_t, fail2ban_log_t) create_files_pattern(fail2ban_t, fail2ban_log_t, fail2ban_log_t) setattr_files_pattern(fail2ban_t, fail2ban_log_t, fail2ban_log_t) @@ -88,7 +89,6 @@ files_read_etc_runtime_files(fail2ban_t) files_list_var(fail2ban_t) files_dontaudit_list_tmp(fail2ban_t) -fs_list_inotifyfs(fail2ban_t) fs_getattr_all_fs(fail2ban_t) auth_use_nsswitch(fail2ban_t) @@ -100,6 +100,10 @@ logging_read_syslog_pid(fail2ban_t) logging_dontaudit_search_audit_logs(fail2ban_t) logging_mmap_generic_logs(fail2ban_t) logging_mmap_journal(fail2ban_t) +logging_watch_audit_log_files(fail2ban_t) +logging_watch_audit_log_dirs(fail2ban_t) +logging_watch_generic_log_dirs(fail2ban_t) +logging_watch_journal_dir(fail2ban_t) mta_send_mail(fail2ban_t) https://src.fedoraproject.org/rpms/fail2ban/c/6dbaddcefe8af280f6c8a224143c7…

1 0

orion pushed to rpms/fail2ban (epel8). "Add patch to SCM."
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:03 UTC From 1a7cc53458e9df82063a0aa277c2d0c3f1ee08dd Mon Sep 17 00:00:00 2001 From: Richard Shaw <hobbes1069(a)gmail.com> Date: Jan 06 2021 13:08:55 +0000 Subject: Add patch to SCM. --- diff --git a/f259dac74721c00f0184bf45277137771fc747fe.patch b/f259dac74721c00f0184bf45277137771fc747fe.patch new file mode 100644 index 0000000..ba399ae --- /dev/null +++ b/f259dac74721c00f0184bf45277137771fc747fe.patch @@ -0,0 +1,48 @@ +From 747d4683221b5584f9663695fb48145689b42ceb Mon Sep 17 00:00:00 2001 +From: sebres <info(a)sebres.de> +Date: Mon, 4 Jan 2021 02:42:38 +0100 +Subject: [PATCH] fixes century selector of %ExY and %Exy in datepattern for + tests, considering interval from 2005 (alternate now) to now; + better + grouping algorithm for resulting century RE + +--- + fail2ban/server/strptime.py | 24 ++++++++++++++++++++++-- + 1 file changed, 22 insertions(+), 2 deletions(-) + +diff --git a/fail2ban/server/strptime.py b/fail2ban/server/strptime.py +index 1464a96d1..39fc79586 100644 +--- a/fail2ban/server/strptime.py ++++ b/fail2ban/server/strptime.py +@@ -36,10 +36,30 @@ def _getYearCentRE(cent=(0,3), distance=3, now=(MyTime.now(), MyTime.alternateNo + Thereby respect possible run in the test-cases (alternate date used there) + """ + cent = lambda year, f=cent[0], t=cent[1]: str(year)[f:t] ++ def grp(exprset): ++ c = None ++ if len(exprset) > 1: ++ for i in exprset: ++ if c is None or i[0:-1] == c: ++ c = i[0:-1] ++ else: ++ c = None ++ break ++ if not c: ++ for i in exprset: ++ if c is None or i[0] == c: ++ c = i[0] ++ else: ++ c = None ++ break ++ if c: ++ return "%s%s" % (c, grp([i[len(c):] for i in exprset])) ++ return ("(?:%s)" % "|".join(exprset) if len(exprset[0]) > 1 else "[%s]" % "".join(exprset)) \ ++ if len(exprset) > 1 else "".join(exprset) + exprset = set( cent(now[0].year + i) for i in (-1, distance) ) + if len(now) and now[1]: +- exprset |= set( cent(now[1].year + i) for i in (-1, distance) ) +- return "(?:%s)" % "|".join(exprset) if len(exprset) > 1 else "".join(exprset) ++ exprset |= set( cent(now[1].year + i) for i in xrange(-1, now[0].year-now[1].year+1, distance) ) ++ return grp(sorted(list(exprset))) + + timeRE = TimeRE() + https://src.fedoraproject.org/rpms/fail2ban/c/1a7cc53458e9df82063a0aa277c2d…

1 0

orion pushed to rpms/fail2ban (epel8). "Fix CVE-2021-32749 RHBZ#1983223"
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:03 UTC From 8860a0809fca3950ad4828c2b5948bcc672087b6 Mon Sep 17 00:00:00 2001 From: Mikel Olasagasti Uranga <mikel(a)olasagasti.info> Date: Oct 07 2021 15:03:16 +0000 Subject: Fix CVE-2021-32749 RHBZ#1983223 --- diff --git a/fail2ban.spec b/fail2ban.spec index 77b920a..93ad3d9 100644 --- a/fail2ban.spec +++ b/fail2ban.spec @@ -1,6 +1,6 @@ Name: fail2ban Version: 0.11.2 -Release: 8%{?dist} +Release: 9%{?dist} Summary: Daemon to ban hosts that cause multiple authentication errors License: GPLv2+ @@ -21,6 +21,8 @@ Patch1: https://github.com/fail2ban/fail2ban/commit/f259dac74721c00f0184bf452771 # Python 3.10a5 compatibility # https://bugzilla.redhat.com/show_bug.cgi?id=1926201 Patch2: https://github.com/fail2ban/fail2ban/compare/ea26509594a3220b012071604d73bb… +# CVE-2021-32749 https://github.com/fail2ban/fail2ban/security/advisories/GHSA-m985-3f3v-cwmm +Patch3: https://github.com/fail2ban/fail2ban/commit/410a6ce5c80dd981c22752da034f252… BuildArch: noarch @@ -397,6 +399,9 @@ fi %changelog +* Sun Sep 26 2021 Mikel Olasagasti Uranga <mikel(a)olasagasti.info> - 0.11.2-9 +- Fix CVE-2021-32749 RHBZ#1983223 + * Wed Jul 21 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.11.2-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild https://src.fedoraproject.org/rpms/fail2ban/c/8860a0809fca3950ad4828c2b5948…

1 0

orion pushed to rpms/fail2ban (epel8). "- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild (..more)"
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:03 UTC From 796f2eb44ee179b54528625884038f7c34bc42d8 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering <releng(a)fedoraproject.org> Date: Jan 20 2022 02:37:32 +0000 Subject: - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng(a)fedoraproject.org> --- diff --git a/fail2ban.spec b/fail2ban.spec index fc96869..224a893 100644 --- a/fail2ban.spec +++ b/fail2ban.spec @@ -1,6 +1,6 @@ Name: fail2ban Version: 0.11.2 -Release: 9%{?dist} +Release: 10%{?dist} Summary: Daemon to ban hosts that cause multiple authentication errors License: GPLv2+ @@ -407,6 +407,9 @@ fi %changelog +* Thu Jan 20 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.11.2-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Sun Sep 26 2021 Mikel Olasagasti Uranga <mikel(a)olasagasti.info> - 0.11.2-9 - Fix CVE-2021-32749 RHBZ#1983223 https://src.fedoraproject.org/rpms/fail2ban/c/796f2eb44ee179b54528625884038…

1 0

orion pushed to rpms/fail2ban (epel8). "Add patch for tests to deal with 2021."
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:02 UTC From 142cd904bf602190168a79908d1a55e25e89489c Mon Sep 17 00:00:00 2001 From: Richard Shaw <hobbes1069(a)gmail.com> Date: Jan 06 2021 13:02:20 +0000 Subject: Add patch for tests to deal with 2021. --- diff --git a/fail2ban.spec b/fail2ban.spec index dd2660a..92dc81e 100644 --- a/fail2ban.spec +++ b/fail2ban.spec @@ -15,6 +15,9 @@ Source4: Makefile # https://bugzilla.redhat.com/show_bug.cgi?id=1379141 # https://bugzilla.redhat.com/show_bug.cgi?id=1573185 Patch0: fail2ban-partof.patch +# Fixes century selector for tests +# https://bugzilla.redhat.com/show_bug.cgi?id=1912472 +Patch1: https://github.com/fail2ban/fail2ban/commit/f259dac74721c00f0184bf452771377… BuildArch: noarch https://src.fedoraproject.org/rpms/fail2ban/c/142cd904bf602190168a79908d1a5…

1 0

orion pushed to rpms/fail2ban (epel8). "Rebuilt for Python 3.10"
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:03 UTC From d44049eee64429cdc0b7cd900374a88a995e781a Mon Sep 17 00:00:00 2001 From: Python Maint <python-maint(a)redhat.com> Date: Jun 04 2021 18:04:02 +0000 Subject: Rebuilt for Python 3.10 --- diff --git a/fail2ban.spec b/fail2ban.spec index 5a069e4..f2759a2 100644 --- a/fail2ban.spec +++ b/fail2ban.spec @@ -1,6 +1,6 @@ Name: fail2ban Version: 0.11.2 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Daemon to ban hosts that cause multiple authentication errors License: GPLv2+ @@ -397,6 +397,9 @@ fi %changelog +* Fri Jun 04 2021 Python Maint <python-maint(a)redhat.com> - 0.11.2-5 +- Rebuilt for Python 3.10 + * Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl> - 0.11.2-4 - Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. https://src.fedoraproject.org/rpms/fail2ban/c/d44049eee64429cdc0b7cd900374a…

1 0

orion pushed to rpms/fail2ban (epel8). "Add patch for python 3.11."
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:04 UTC From fb9a87495ac4dc2cbbae4ad703824bd6b3dd5a02 Mon Sep 17 00:00:00 2001 From: Richard Shaw <hobbes1069(a)gmail.com> Date: Jul 26 2022 02:29:30 +0000 Subject: Add patch for python 3.11. --- diff --git a/3267.patch b/3267.patch new file mode 100644 index 0000000..9fa335e --- /dev/null +++ b/3267.patch @@ -0,0 +1,86 @@ +From 500895dcfa31f11c81b3c9128781a49a05e3bd05 Mon Sep 17 00:00:00 2001 +From: "Sergey G. Brester" <serg.brester(a)sebres.de> +Date: Mon, 25 Apr 2022 18:53:19 +0200 +Subject: [PATCH 1/5] GHA: update python 3.11 version + +--- + .github/workflows/main.yml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +Index: fail2ban-0.11.2/fail2ban/server/datetemplate.py +=================================================================== +--- fail2ban-0.11.2.orig/fail2ban/server/datetemplate.py ++++ fail2ban-0.11.2/fail2ban/server/datetemplate.py +@@ -35,6 +35,7 @@ logSys = getLogger(__name__) + # check already grouped contains "(", but ignores char "$" and conditional "(?(id)...)": + RE_GROUPED = re.compile(r'(?<!(?:\(\?))(?<!\$$(?!\?)') + RE_GROUP = ( re.compile(r'^((?:\(\?\w+$)?\^?(?:$\?\w+$)?)(.*?)(\$?)$'), r"\1(\2)\3" ) ++RE_GLOBALFLAGS = re.compile(r'((?:^|(?!<\\))$\?[a-z]+$)') + + RE_EXLINE_NO_BOUNDS = re.compile(r'^\{UNB\}') + RE_EXLINE_BOUND_BEG = re.compile(r'^\{\^LN-BEG\}') +@@ -110,6 +111,11 @@ class DateTemplate(object): + # because it may be very slow in negative case (by long log-lines not matching pattern) + + regex = regex.strip() ++ # cut global flags like (?iu) from RE in order to pre-set it after processing: ++ gf = RE_GLOBALFLAGS.search(regex) ++ if gf: ++ regex = RE_GLOBALFLAGS.sub('', regex, count=1) ++ # check word boundaries needed: + boundBegin = wordBegin and not RE_NO_WRD_BOUND_BEG.search(regex) + boundEnd = wordEnd and not RE_NO_WRD_BOUND_END.search(regex) + # if no group add it now, should always have a group(1): +@@ -135,6 +141,8 @@ class DateTemplate(object): + self.flags |= DateTemplate.LINE_END + # remove possible special pattern "**" in front and end of regex: + regex = RE_DEL_WRD_BOUNDS[0].sub(RE_DEL_WRD_BOUNDS[1], regex) ++ if gf: # restore global flags: ++ regex = gf.group(1) + regex + self._regex = regex + logSys.log(7, ' constructed regex %s', regex) + self._cRegex = None +Index: fail2ban-0.11.2/fail2ban/server/failregex.py +=================================================================== +--- fail2ban-0.11.2.orig/fail2ban/server/failregex.py ++++ fail2ban-0.11.2/fail2ban/server/failregex.py +@@ -91,6 +91,13 @@ R_MAP = { + "port": "fport", + } + ++# map global flags like ((?i)xxx) or (?:(?i)xxx) to local flags (?i:xxx) if supported by RE-engine in this python version: ++try: ++ re.search("^re(?i:val)$", "reVAL") ++ R_GLOB2LOCFLAGS = ( re.compile(r"(?<!\\)$(?:\?:)?(\(\?[a-z]+)$"), r"\1:" ) ++except: ++ R_GLOB2LOCFLAGS = () ++ + def mapTag2Opt(tag): + tag = tag.lower() + return R_MAP.get(tag, tag) +@@ -128,6 +135,9 @@ class Regex: + # + if regex.lstrip() == '': + raise RegexException("Cannot add empty regex") ++ # special handling wrapping global flags to local flags: ++ if R_GLOB2LOCFLAGS: ++ regex = R_GLOB2LOCFLAGS[0].sub(R_GLOB2LOCFLAGS[1], regex) + try: + self._regexObj = re.compile(regex, re.MULTILINE if multiline else 0) + self._regex = regex +Index: fail2ban-0.11.2/fail2ban/tests/fail2banclienttestcase.py +=================================================================== +--- fail2ban-0.11.2.orig/fail2ban/tests/fail2banclienttestcase.py ++++ fail2ban-0.11.2/fail2ban/tests/fail2banclienttestcase.py +@@ -600,6 +600,11 @@ class Fail2banClientTest(Fail2banClientS + os.kill(pid, signal.SIGCONT) + self.assertLogged("timed out") + self.pruneLog() ++ # check readline module available (expected by interactive client) ++ try: ++ import readline ++ except ImportError as e: ++ raise unittest.SkipTest('Skip test because of import error: %s' % e) + # interactive client chat with started server: + INTERACT += [ + "echo INTERACT-ECHO", diff --git a/fail2ban.spec b/fail2ban.spec index 6d7b302..d03608d 100644 --- a/fail2ban.spec +++ b/fail2ban.spec @@ -27,6 +27,7 @@ Patch3: https://github.com/fail2ban/fail2ban/commit/410a6ce5c80dd981c22752da034f #Patch4: https://github.com/fail2ban/fail2ban/commit/ebf5784b8cd4b7c52d0f328b780833b… # https://bugzilla.redhat.com/show_bug.cgi?id=2034205 Patch5: fail2ban-python311.patch +Patch6: https://patch-diff.githubusercontent.com/raw/fail2ban/fail2ban/pull/3267.pa… BuildArch: noarch https://src.fedoraproject.org/rpms/fail2ban/c/fb9a87495ac4dc2cbbae4ad703824…

1 0

← Newer
1
2
3
4
5
6
7
...
3623
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

scm-commits March 2023